Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Bugtraq: Re: Horde webmail: mysql access

Re: Horde webmail: mysql access

From: Christopher T. Beers <ctbeers_at_syr.edu>
Date: Mon, 26 Apr 2004 20:51:04 -0400

--On Sunday, April 25, 2004 11:11 PM +0200 sig_at_flaming.tolna.net wrote:

| Hello
| ....
| By default, You can access to these database servers, with the username:
| "horde" and with no password, from a remote host. Then you will have
| permission to list the databases, and to use some of them. In fact,
| "horde" and "test" databases are available for reading, and writing, in
| many cases.
|
| ....

If you read the horde_src/docs/INSTALL file there is a section when you
configure it that says

   Be sure to change the default password, "horde", to something
   else before creating the tables! (Remember to use this password
   when you configure Horde in the next step.)

Also the script that creates the mysql database located at
horde_src/scripts/db/mysql_create.sql has the following items. Again a
warning about changing the password...

USE mysql;

REPLACE INTO user (host, user, password)
    VALUES (
        'localhost',
        'horde',
  -- IMPORTANT: Change this password!
        PASSWORD('horde')
    );

Obviously, this was overlooked in whatever installation you were looking
at. In fact, it looks like your administrator removed the default horde
password and replaced it with nothing...even worse than using the default
password.

-- 
Christopher T. Beers	
UNIX Systems Engineer - Syracuse University
250 Machinery Hall	Syracuse, NY 13244
(315) 443-4103 Office	(315) 443-1621 Fax
Received on Apr 28 2004
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos